CVE-2026-8794
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
PaperCut NG/MF has an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can enumerate usernames by measuring response times during login attempts.
Risk Assessment
An attacker can discover valid usernames, facilitating further attacks such as password brute-forcing.
Recommendation
Apply a fix that eliminates the timing discrepancy, e.g., by always performing password hash comparison regardless of account existence.
Other vulnerabilities in PaperCut NG/MF
See all- CVE-2026-14780High
A vulnerability exists in the PaperCut NG/MF platform's device-scripting functionality due to insufficient sanitization and access restrictions within the embedded execution engine. An authenticated user with administrative access to the management interface can supply a malicious script that escapes the runtime sandbox. A successful execution enables an attacker to run unauthorized operating system commands with administrative privileges on the host operating system.
- CVE-2026-8793Medium
PaperCut NG/MF does not properly restrict excessive authentication attempts within its login component. An unauthenticated remote attacker can exploit this vulnerability to perform unrestricted brute-force or credential-stuffing attacks without triggering account lockout or rate-limiting mechanisms in some configurations.
Original NVD description (English source)
PaperCut NG/MF contains an observable timing discrepancy in its authentication component. An unauthenticated remote attacker can exploit this vulnerability to perform username enumeration by measuring response times during login attempts. The system executes a password hash comparison only when a valid account is supplied, creating a measurable timing oracle that reveals account existence.